CVE-2024-53798: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in BAKKBONE Australia's FloristPress plugin affecting versions up to 7.3.0. The vulnerability was reported on November 9, 2024, and publicly disclosed on December 2, 2024. This security issue affects the WordPress plugin FloristPress and could allow unauthorized content deletion (Patchstack).

The vulnerability has been assigned CVE-2024-53798 and received a CVSS v3.1 score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The issue is classified as CWE-862: Missing Authorization, which could lead to broken access control (NVD).

The vulnerability could allow a malicious actor with Subscriber-level access to perform arbitrary content deletion on the affected website, including pictures, posts, or pages (Patchstack).

The vulnerability requires an attacker to have at least Subscriber-level privileges to exploit. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been patched in version 7.4.0 of the FloristPress plugin. Users are advised to update to version 7.4.0 or later to remove the vulnerability (Patchstack).